8.5Hoch

CVE-2026-33379Dashboard snapshot permission bypass

Grafana Grafana OSS; Grafana Grafana Enterprise Veröffentlicht: 2026-11-06 13:05 (vor 5 Tagen)

Beschreibung

A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not.

Schwachstellentyp (CWE): CWE-862

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
Grafana	Grafana Enterprise	12.4.0 – < 12.4.4
Grafana	Grafana OSS	12.4.0 – < 12.4.4

Referenzen und Patches

https://grafana.com/security/security-advisories/cve-2026-33379 vendor-advisory

CVSS-Score

8.5Hoch

Quelle: GRAFANA · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Niedrig
Benutzerinteraktion: Keine
Geltungsbereich: Geändert
Vertraulichkeit: Hoch
Integrität: Niedrig
Verfügbarkeit: Keine

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Alle Scores (2)

cna	CVSS 3.1	8.5Hoch
security@grafana.com	CVSS 3.1	8.5Hoch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.21%

höher als 11 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: no
Technische Auswirkung: partial

Zeitverlauf

ID reserviert2026-03-19
Veröffentlicht2026-11-06 13:05
Bei IP-DB eingegangen2026-11-06 14:03
Zuletzt aktualisiert2026-11-10 21:17

Vergeben von (CNA): GRAFANA
NVD-Status: Received

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Grafana

6.0Mittel

CVE-2026-79656 vor 13 Tagen

OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors

Grafana Grafana OSS; Grafana Grafana Enterprise

A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to it…

8.9Hoch

CVE-2026-103506 vor 13 Tagen

SSO settings authorization bypass

Grafana Grafana Enterprise; Grafana Grafana OSS

An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettings…

6.5Mittel

CVE-2026-88858 vor 13 Tagen

Server-side expression parser denial of service

Grafana Grafana OSS; Grafana Grafana Enterprise

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.

7.7Hoch

CVE-2026-88967 vor 13 Tagen

Azure Monitor access token disclosure via SSRF

Grafana Grafana Enterprise; Grafana Grafana OSS

A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).

7.7Hoch

CVE-2026-100105 vor 13 Tagen

Alerting contact point authorization bypass via schema downgrade

Grafana Grafana Enterprise; Grafana Grafana OSS

A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect ale…

6.5Mittel

CVE-2026-16491 vor 14 Tagen

CVE-2026-16491 CVE Record

Grafana Grafana Enterprise; Grafana Grafana OSS

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of ever…